EP2486509B1 - Plattformsicherheit - Google Patents

Plattformsicherheit Download PDF

Info

Publication number
EP2486509B1
EP2486509B1 EP10821668.0A EP10821668A EP2486509B1 EP 2486509 B1 EP2486509 B1 EP 2486509B1 EP 10821668 A EP10821668 A EP 10821668A EP 2486509 B1 EP2486509 B1 EP 2486509B1
Authority
EP
European Patent Office
Prior art keywords
application
resource
resources
application software
software
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
EP10821668.0A
Other languages
English (en)
French (fr)
Other versions
EP2486509A1 (de
EP2486509A4 (de
Inventor
Janne Sakari Mantyla
Mikael Buchholtz
Markku Kylanpaa
Markku Savela
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Nokia Technologies Oy
Original Assignee
Nokia Technologies Oy
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Nokia Technologies Oy filed Critical Nokia Technologies Oy
Priority to EP22204745.8A priority Critical patent/EP4191453A1/de
Publication of EP2486509A1 publication Critical patent/EP2486509A1/de
Publication of EP2486509A4 publication Critical patent/EP2486509A4/de
Application granted granted Critical
Publication of EP2486509B1 publication Critical patent/EP2486509B1/de
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575—Secure boot
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F8/00—Arrangements for software engineering
    • G06F8/60—Software deployment
    • G06F8/61—Installation
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/46—Multiprogramming arrangements
    • G06F9/468—Specific access rights for resources, e.g. using capability register
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/102—Entity profiles
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2149—Restricted operating environment

Definitions

  • the exemplary and non-limiting embodiments of this invention relate generally to techniques in software development and execution systems, methods, devices and computer programs and, more specifically, relate to providing techniques of resource access control to a software application, such as a software application intended to execute in a device having e.g., wireless communication capabilities.
  • D-Bus was designed to allow communication between system-level processes (such as printer and hardware driver services) and normal user processes.
  • D-bus uses a fast, binary message-passing protocol, which is suitable for same-machine communication due to its low latency and low overhead.
  • D-Bus buses are used when many-to-many communication is desired.
  • this server is responsible for keeping track of the applications that are connected and for properly routing messages from their source to their destination.
  • D-Bus defines two well-known buses, called the system bus and the session bus.
  • buses are special in the sense that they have well-defined semantics: some services are defined to be found in one or both of these buses. For example, an application wishing to query the list of hardware devices attached to a computer will likely communicate to a service available on the system bus, while a service providing for the opening of a web browser will likely be found. On the system bus, one can also expect to find restrictions on what services each application is allowed to offer.
  • a method comprising receiving, at a device, from a source a package comprising a binary file representing an application software and an associated resource declaration indicating resources required by the application software, extracting the resource declaration from the package, forming an intersection of the extracted resource declaration and a set of allowable resources, for the source of the package, obtained from a software sources ranking and resources usage policy, granting the application software resources based on the result of the formed intersection, installing the application software, and storing an indication of the granted resources in a resource possession list.
  • an apparatus comprising means for receiving from a source a package comprising a binary file representing an application software and an associated resource declaration indicating resources required by the application software, means for extracting the resource declaration from the package, and means for forming an intersection of the extracted resource declaration and a set of allowable resources, for the source of the package, obtained from a software sources ranking and resources usage policy, means for installing the application software, and means for storing an indication of the granted resources in a resource possession list.
  • the exemplary embodiments of this invention apply and extend aspects of UNIX AC to fulfill the foregoing criteria, and employ a multi-user model to provide application level AC.
  • the exemplary embodiments of this invention adhere to a "principle of least privileges" of access control, where an application should be able to access only a limited set of resources actually needed by that application.
  • Certain resources may be considered to be protected resources such as, but not limited to, cellular communication functionality and location/mapping functionality.
  • An application must declare those resources that it needs. The declaration of needed resources may be in the form of a manifest file.
  • Figure 1 shows a device 10 that uses Linux and that conceptually contains a user mode 12 and a kernel mode 14 according to one embodiment.
  • One or more applications are loaded from a (trusted) source 1.
  • a given SW obtains its rights based on its source code and the manifest file. This entails creation, during the software development phase, of the manifest file to specify the resources needed by the SW, and placing the SW and associated manifest file into a suitable repository or source.
  • Figure 1 shows the (trusted) source 1 containing one or more applications (App 1 , App 2 ... App N ) according to one embodiment. It can be assumed that there are quality assurance checks associated with the source 1.
  • a security policy file is accessible in one embodiment only for an installer 12A that forms a part of the user mode 12, and in another embodiment the security policy file itself is readable by installers not yet in the user mode.
  • a device policy 12B which would be used to identify and verify trusted source(s) 1, a D-Bus daemon 12C and a D-Bus policy 12D.
  • the D-Bus daemon includes D-Bus extensions 12E.
  • the kernel mode 14 includes, further in accordance with an aspect of the exemplary embodiments of this invention, a resource possession list 14A and a process credentials assigner 14B. Also included are a Linux kernel reference monitor 14C and a file's AC lists 14D.
  • FIG. 2 shows the foregoing components in somewhat greater detail, and provides an overview of the principle of least privileges enforcement according to one embodiment.
  • Subject is an active entity, which represents a system's user or system process in the computer system. By a subject, one may denote a process in the system, meaning that the access control is process-based.
  • Object is a passive entity, which represents a file, a system resource or even a subject. The latter means that, for example, an executable file is an object of a computer system, but when it starts to execute it becomes a subject of this system.
  • resource is used to denote objects in the system.
  • access type an operation that a subject can perform on an object.
  • the concrete meaning of access type depends on the computer system.
  • file server it can be an ability to read an object (file), to write it, to execute and so forth.
  • access type can be an ability to insert a new record into a table, to search for data in the database and so forth.
  • the principle of least privilege may thus be defined as "every subject must be able to access only such objects that are necessary to its legitimate purpose”.
  • the installer 12A may be considered as the "entrance door" for new applications, application updates, device policy updates and key updates.
  • the software sources ranking and resources usage policy (SSRRU policy) is embodied in the device policy block 12B of Figure 1 .
  • the SSRRU policy defines the possible known sources of SW for the device 10, their hierarchy, and allowed resources for each of them.
  • the SSRRU policy may specify that there are two known sources: Source1 and Source2, where Source1 is considered to be more trusted than Source2; and SW from Source1 is allowed to use any possible resources, while SW from Source2 may only use Resource1 and Resource2.
  • the SSRRU policy may be defined by a manufacturer of the device or an operator, if, for example, a device is intended to be distributed via special promotions.
  • an operator may sell a device to an end-user for a small price, but in one embodiment the user is expected to use only a set of SW sources defined by the manufacturer/operator while in another embodiment the user is allowed to use only the manufacturer's/operator's set of SW sources which may be e.g., a SW repository.
  • This policy can be later changed by an authorized policy update. If there are no restrictions enabled on the device, a user can add new sources of SW and assign a list of allowed resources to them. However, the user cannot change the hierarchy of device predefined sources; and cannot grant some sensitive resource(s) to new sources of SW.
  • the D-Bus is an inter-processor communication (IPC) system for software applications to communicate with each other.
  • IPC inter-processor communication
  • D-Bus allows programs to register and offer services to others, and it also allows access control rights to be defined for these services.
  • Access control rights for each D-Bus service can be declared in the D-Bus policy file 12D. Thus, it is possible to define which subject (process) is allowed to access a particular D-Bus service.
  • the D-Bus reference monitor is a part of the D-Bus daemon 12C, and makes access control decisions based on D-Bus policy, process credentials and the service requested. For example, Process 1 wants to send a message to a Service1.
  • the D-Bus reference monitor will check in the D-Bus policy 12D if Process1 is allowed to send a message to Service1. Depending on the policy in place the message will be sent or declined.
  • the D-Bus reference monitor is extended, in accordance with an aspect of this invention, to include the extensions 12E.
  • the kernel mode 14 components include object's access control list 14D.
  • the access control list (ACL) associates with each object in a computer system a list of the system's subjects (which have at least one access right to the object in question).
  • the ACL is typically stored with the object.
  • For the file system AC it may be preferred to use an existing Unix ACL, which can specify access types for owner, owner's group and others.
  • the access types are "read”, "write” and "execute”.
  • the kernel mode 14 also includes the process credentials assigner 14B which, in accordance with an aspect of this invention, is enabled to modify process credentials at the moment when a process starts to execute.
  • the Linux kernel reference monitor 14C is a distributed entity which makes an AC decision based on process credentials and an object's ACLs.
  • Figure 4 described below, provide additional details concerning the Linux kernel reference monitor functionality, according to one embodiment.
  • the resource possession list 14A defines which resources are allowed to be accessed by a process in the system.
  • the list contains a mapping between application identifiers and allowed resources for each such application.
  • An application identifier fulfills the following requirements: it should be impossible to forge; it should be unique (identify an application uniquely); and it should remain the same for application updates, between boot-ups, for different instances of the same application, and after application restart.
  • the example may be a current domain name of a repository (for example: Nokia, Maemo), or a unique identifier derived from a key certificate.
  • a resource is a virtual object which represents some functionality. It can be a file on the filesystem, a D-Bus service and so on. Resources are described using resource token strings. For example: “Location”, “Network-Costly”, etc. There is a special service in the system which defines for each sensitive system resource a resource token which should protect this resource. For example, consider a "Network-Costly” resource token. It represents access to all communication channels which may incur costs to a user.
  • the real system objects that are protected by this resource are filesystem objects (such as network configuration files), the possibility to execute "Connect” and "Bind" commands.
  • An initial set of protected resources may include a small set of predefined resources (such as access to user's data, location information, network services and so forth).
  • each application has a possibility to define a new resource which the application itself provides. In this case it is important to ensure that there are no conflicts in the resource's namespace which may be done, for example, by an authority that certifies SW.
  • Figures 1 and 3 show an exemplary interaction between these various components for the case of a new application installation.
  • an application arrives at the installer 12A (the arrow labeled 1).
  • the installer 12A checks the device policy 12B for information concerning the source 1 from which the application arrived (the arrow labeled 2).
  • the installer 12A modifies the resource possession list 14A accordingly for the application (the arrow labeled 3).
  • the installer 12A also accordingly modifies the D-Bus policy 12D.
  • the installer 14A at 3B checks the software sources ranking and resources usage policy in the SSRRU policy 12B to determine if the source 1 is known, and what kind of resources are allowed for SW from this source.
  • the installer 12A extracts the resource declarations from the package, and makes an intersection of the extracted resource declarations and the set of resources obtained from the SSRRU policy 12B. The package is then installed.
  • Some user-related resources such as an ability to read user data, network communication and so forth may also be granted by a user.
  • the installer 12A modifies the resource possession list 14A by adding a new rule for the new package, where the set of allowed resources is an intersection of package-requested resources and the set of resources defined by the SSRRU 12B for the source 1 of the SW.
  • the process of forming a result set of allowed resources is depicted in Figure 4 .
  • the installer 12A also modifies the D-Bus policy 12D if the new application defines a new D-Bus service.
  • Figures 5 , 6 , 7 and 8 show the interaction of the components at application run time according to one embodiment of the invention.
  • the process credentials assigner 14B obtains the allowed set of resources from the resource possession list 14A (arrow labeled 1), and (arrow labeled 2) the process credentials assigner 14B modifies the process' credentials 14B' (process task structure).
  • the Linux reference monitor 14C makes an AC decision based on the process's credentials 14B' and the file system AC lists 14D.
  • the D-Bus daemon 12C makes an AC decision based on the process credentials 14B' and D-Bus policy 12D.
  • the application calls the library to obtain process credentials, and makes a decision based on the process credentials 14B' and its own policy.
  • the run-time access control can be done at different levels, depending on the action that application attempts to perform (for example, file access or sending a D-Bus message), and the actual level of delegation of the AC decision.
  • the latter means that the application can rely on the operating system or the D-Bus to protect the resource it provides, or may provide its own protection.
  • Figure 6 shows a MSC for the non-limiting case of filesystem access, when the access to a file is constrained by its file permissions.
  • the access rights check is delegated to the Linux kernel reference monitor 14C.
  • a sys_execve kernel function is called. This function is enhanced so that it calls (at 6A) the process credentials assigner 14B, which makes a look-up in the resource possession list 14A and assigns corresponding process credentials to the process (6B). This is done by modifying the task kernel structure (at 6C the process credentials assigner 14B modifies the application's credentials according to the set of allowed resources). Control is then transferred to the application and the application executes at 6D.
  • the Linux kernel reference monitor 14C obtains its credentials, ACLs of an object (for the filesystem object, in this case the file's permissions 18) and, based on this information, makes an access control decision (6E). In Linux this is done inside system calls, for example inside a sysopen call for the case shown in the Figure 6 .
  • the interactions labeled 6F generally show the operation for the case where the access control is allowed or denied.
  • FIG. 7 is the MSC run-time in a case of D-Bus access control.
  • the access control decision is made by theD-Bus reference monitor (D-Bus daemon 12C), which takes into account process credentials, the service that the process wants to access and the D-Bus policy.
  • D-Bus daemon 12C the D-Bus reference monitor
  • There are two applications in Figure 7 according to one embodiment: a D-Bus client 20A and a D-Bus server 20B.
  • the D-Bus client 20A is started in the same manner as the application described in Figure 6 (generally shown as 7A).
  • the D-Bus server is assumed to be started in the same way as well (and this is omitted from Figure 7 ).
  • the D-Bus client 20A After a successful start the D-Bus client 20A attempts to connect to the D-Bus via the D-Bus daemon 12C (7B).
  • the D-Bus daemon 12C obtains the D-Bus client credentials (either from its process task structure or in a simple case, it uses a static mapping from the system configuration file) and the D-Bus policy rules from D-Bus policy file 12D. Based on the obtained information the D-Bus daemon 12C creates a memory representation of the policy for the client 20A (D-Bus connection policy 12D shown at 7D).
  • D-Bus client 20A sends a message to the D-Bus server 20B (7E), it first sends it to the D-Bus daemon 12C.
  • the D-Bus daemon 12C checks the connection policy 12D and makes an access control decision based on it (7F). As a result, the message is ether passed to its intended receiver (to the D-Bus server 20B in this case) or the D-Bus client 20A receives an error message (7F).
  • FIG. 7 shows the policy 12D as separate from the daemon 12C
  • the policy is not a physically separate component but is a part of the running D-Bus daemon hosting the ruleset that is allowed. So for example a client wanting to connect to the server using the D-Bus means that the client makes a socket connection to the D-Bus daemon, which makes the access control decision based on the 1) credentials assigned to the client, 2) D-Bus policy, and if the access is approved, theD-Bus daemon makes a socket connection to the server.
  • Figure 8 shows a case where an application makes access control decision by itself.
  • a certain application application server 28
  • the database 30 is stored in a file system, and only the application server 28 can access this file. This can be done, for example, by specifying the permissions of the file in a conventional UNIX way (for example, by setting the file to be readable and writable only by the owner).
  • the application server 28 needs to have a reliable way of obtaining the credentials of another application (application client 34) that wants to access the database 30. This is accommodated by providing a credentials library (libcred) 32, which provides the ability for the application client 34 to obtain the needed information from the application server 28.
  • libcred credentials library
  • FIG. 8 it is assumed that the application client is launched as described previously (shown at 8A).
  • the application client 34 makes a read request for database information from the application server 28.
  • the application server 28 accesses the library 32 to obtain the credentials of the application client 34, and makes a decision of whether to grant access to the database 30.
  • ⁇ D indicates the actions for the case where access is granted or access is denied.
  • Figure 9 is a logic flow diagram that illustrates various hardware enables and a boot process (operation of a boot loaded), according to one embodiment of the invention.
  • Figure 9 assumes a presence of a TrEE (for example the presence of an ARM ® Trust Zone) with two main keys: a root public key, and a root device specific key.
  • TrEE for example the presence of an ARM ® Trust Zone
  • the boot ROM integrity is checked. If the integrity is not verified a reset operation occurs (9B) and processing is halted. If the boot ROM integrity is verified the loader integrity is checked (9C). If the integrity is verified a signed SW image is assumed to be present (9D) and can be executed.
  • the restriction of the security functionality is implemented by the TrEE and can include disabling certain DRM keys, and preventing content from a previous mode from being decrypted.
  • the unsigned SW image is then loaded and executed (9H) without any restriction on what the SW image can do once it is executed. The only restrictions on the device are those posed by the restricted security functionality provided by the TrEE.
  • This boot process is to control what gets booted and how, and allowing the bootup of the application's own kernels in a normally closed platform by removing threats that in the past have made it insecure to use applications having their own kernels.
  • This is enabled in an embodiment by making the decision to boot an unknown kernel conditional on the policy and status information, which in the example embodiment the status information is the SIM-lock information.
  • This conditional boot can be overridden by using an operator unlock code, which in an embodiment may be automatically overridden after passage of a preset period of time (e.g., 2 years). Note that disabling certain functionality while booting is not the same as 'secure booting' in which there is no boot whatsoever if the signature fails.
  • FIG 10A shows the operation of integrity protection using a validator function 40 further in accordance with the exemplary embodiments of this invention.
  • the validator function 40 ensures the integrity of the executable components (e.g., binaries and libraries) at run time, and in response to offline attacks.
  • the validator function 40 can be a module of the kernel 14, and it operates to calculate a cryptographic hash of a file (e.g., by using SHA-1). Reference hashes are stored in protected storage 42, and are used to bind an application identity (pathname) to an executable file. When a new application is presented, the validator function 40 calculates the reference hash of the application, signs it using a validator private key, and stores it in the storage 42.
  • the validator function 40 calculates the hash of the application binary 46 and compares the result to the reference hash retrieved from the protected storage 42. If an integrity protection violation is detected (e.g., the component has been modified) then some action is executed. This action depends on an integrity protection policy 44 of the device. Typically loading of the modified component is prevented, but there are also other options available such as stripping all additional privileges from the process, or more simply just logging the violation. If the hashes match the application is authorized for execution, otherwise the application may be denied execution.
  • the integrity protection framework creates a basis for building a trusted environment, where the entity/company responsible for the behavior of its consumer electronics can make any guarantees about the availability of services that a device/hardware is to deliver (e.g., emergency phone calls).
  • a simple digital signature protection framework is not as dynamic, is not flexible, and provides no connection to the access control policies.
  • the integrity protection framework disclosed herein e.g., the Aegis validator
  • the integrity protection framework can also use a local digital signature with secure extension environment secret keys to sign the storage of reference hashes.
  • a file object 46 is identified by an inode structure.
  • the inode number is used as a key to the hash store (42 in Figure 10A ) to request a reference hash value of the inode.
  • the validator 40 recalculates the hash value and, if there is a match, the inode number is stored in the verification cache 48. If the calculated hash value does not match the next action depends on the integrity protection policy 44.
  • the hash store 42 is initialized in system boot using reference hashlist file, which contains pathname - cryptographic hash pairs. Pathname - cryptographic hash pairs are translated into inode - cryptographic hash pairs.
  • the original store is integrity protected using either RSA signature (initial file) or a locally signed HMAC mechanism (local updates).
  • RSA signature initial file
  • HMAC locally signed HMAC mechanism
  • Figure 11 shows the operation of privacy protection using the protected storage 42 shown in Figure 10 , according to one embodiment.
  • the embodiment ensures the integrity of data and configuration files (stored in the protected storage 42) after installation. Additional features include data encryption within the protected storage 42, and the use of private, shared and global or externally signed storages.
  • DRM may be accomplished by creating a resource token termed "DRM" and granting that token only to selected applications coming from the operator's SW repository. Services possessing DRM confidential information (e.g., secret content keys) will only communicate applications having that "DRM" resource token.
  • embodiments of the policy protection framework use dynamic mappings that are created in the installation time from an abstract declaration in the application package.
  • the host device itself creates and maintains a locally unique mapping from resource tokens to user identifiers UIDs and group identifiers GIDs. Creating such new tokens on the fly when installing new SW is not seen in the prior art, nor is binding them to the source of the applications.
  • a limited-access-service can be created without support from the device operator/manufacturer.
  • Figure 12 presents a non-limiting example of a security policy file, according to one embodiment.
  • Figure 13 shows a non-limiting AC control example showing a manifest file for a server and for a client (the latter giving permission for a token server), according to one embodiment.
  • Figures 14A , 14B and 14C provide a non-limiting example for the D-Bus server 20B and D-Bus client 20A (e.g., refer again to Figure 7 ), specifically a manifest file for the D-Bus server 20B, a manifest file for the D-Bus client 20A, and a D-Bus configuration file, respectively, according to one embodiment of the invention.
  • the references to "Aegis" in these Figures, and elsewhere in the description, may be read as being descriptive of a name of the overall security architecture provided by the exemplary embodiments of this invention.
  • Figure 15 illustrates an exemplary device 10 in both plan view (left) and sectional view (right), and the invention may be embodied in one or some combination of the illustrated function-specific components.
  • the device 10 has a graphical display interface 120 and a user interface 122 illustrated as a keypad but understood as also encompassing touch-screen technology at the graphical display interface 120 and voice-recognition technology received at the microphone 124.
  • a power actuator 126 controls the device being turned on and off by the user.
  • the exemplary device 10 may have a camera 128 which is shown as being forward facing (e.g., for video calls) but may alternatively or additionally be rearward facing (e.g., for capturing images and video for local storage).
  • the camera 128 is controlled by a shutter actuator 130 and optionally by a zoom actuator 132.
  • the antennas 136 may be multi-band antennas.
  • a power chip 138 controls power amplification on the channels being transmitted and/or across the antennas that transmit simultaneously where spatial diversity is used, and amplifies the received signals.
  • the power chip 138 outputs the amplified received signal to the radio-frequency (RF) chip 140 which demodulates and downconverts the signal for baseband processing.
  • the baseband (BB) chip 142 detects the signal which is then converted to a bit-stream and finally decoded. Similar processing occurs in reverse for signals generated in the device 10 and transmitted from it.
  • Signals going to and from the camera 128 pass through an image/video processor 144 which encodes and decodes the various image frames.
  • a separate audio processor 146 may also be present controlling signals to and from the speakers 134 and the microphone 124.
  • the graphical display interface 120 is refreshed from a frame memory 148 as controlled by a user interface chip 150 which may process signals to and from the display interface 120 and/or additionally process user inputs from the keypad 122 and elsewhere.
  • Certain embodiments of the device 10 may also include one or more secondary radios such as a wireless local area network radio WLAN 137 and a Bluetooth ® radio 139, which may incorporate an antenna on-chip or be coupled to an off-chip antenna.
  • secondary radios such as a wireless local area network radio WLAN 137 and a Bluetooth ® radio 139, which may incorporate an antenna on-chip or be coupled to an off-chip antenna.
  • Various programs 110C are stored in one or more of the memories.
  • the programs 110C include software that is configured to operate, in cooperation with at least one of the data processors, in accordance with the various embodiments of this invention that were described above.
  • the programs 110C are assumed to include a suitable operating system, such as Linux, and are configured to implement the user mode 12 and the kernel mode 14 functionalities described above.
  • the various applications may be downloaded from the source 1 via wireless communication, or downloaded via a wire to the device 10.
  • All of these components within the device 10 are normally powered by a portable power supply such as a battery 149.
  • processors 138, 140, 142, 144, 146, 150 may operate in a slave relationship to the main processor 110A which may then be in a master relationship to them. Any or all of these various processors of Figure 15 access one or more of the various memories, which may be on-chip with the processor or separate from the processor.
  • the various embodiments of the device 10 can include, but are not limited to, cellular phones, personal digital assistants (PDAs) having wireless communication capabilities, portable computers having wireless communication capabilities, image capture devices such as digital cameras having wireless communication capabilities, gaming devices having wireless communication capabilities, music storage and playback appliances having wireless communication capabilities, Internet appliances permitting wireless Internet access and browsing, as well as portable units or terminals that incorporate combinations of such functions.
  • PDAs personal digital assistants
  • portable computers having wireless communication capabilities
  • image capture devices such as digital cameras having wireless communication capabilities
  • gaming devices having wireless communication capabilities
  • music storage and playback appliances having wireless communication capabilities
  • Internet appliances permitting wireless Internet access and browsing, as well as portable units or terminals that incorporate combinations of such functions.
  • the device 10 may not include wireless communication capabilities, or at least may not include cellular radio communication capabilities.
  • the exemplary embodiments of this invention provide a method, apparatus and computer program product(s) to provide an enhanced security architecture for a user device.
  • a method comprises receiving from a source a package comprising a binary file representing an application software and an associated resource declaration indicating resources required by the software application (Block 16A).
  • the method further comprises extracting the resource declarations from the package (Block 16B), and forming an intersection of the extracted resource declarations and a set of allowable resources, for the source of the package, obtained from a software sources ranking and resources usage policy (Block 16C).
  • the method further comprises granting the application software resources based on the result of the formed intersection (Block 16D), installing the application software (Block 16E), and storing an indication of the granted resources in a resource possession list (Block 16F).
  • a method comprises (at Block 17A) initiating an application software execution by calling a process credentials assigner to make a look-up in the resource possession list for the software application, (Block 17B) assigning corresponding process credentials according to a set of allowed resources for the software application; (Block 17C) transferring control to the software application and (in Block 17D), in response to a request by the application software to access a system object, making an access control decision based on assigned process credentials and an access control list associated with the system object.
  • a method comprises (at Block 18A) calculating a cryptographic hash of an executable and, at Block 18B, signing the cryptographic hash and storing a resulting reference signed cryptographic hash in a protected storage.
  • the method further comprises, prior to executing the executable, calculating the cryptographic hash of the executable (Block 18C), and comparing a result to the reference cryptographic hash retrieved from the protected storage (Block 18D). If an integrity protection violation is detected, the method further comprises taking some action depending on an integrity protection policy (Block 18E).
  • a method, apparatus, and executable computer program to perform actions comprising receiving, at a device, from a source a package comprising a binary file representing an application software and an associated resource declaration indicating resources required by the application software, extracting the resource declaration from the package, forming an intersection of the extracted resource declaration and a set of allowable resources, for the source of the package, obtained from a software sources ranking and resources usage policy, granting the application software resources based on the result of the formed intersection, installing the application software, and storing an indication of the granted resources in a resource possession list.
  • the resource possession list defines which resources are allowed to be accessed by the application software, and wherein the resource possession list comprises a mapping between an application identifier of the application software and the allowed resources.
  • the application identifier uniquely identifies an application, and wherein the application identifier remains unchanged at least between bootups, for different instances of a same application, and after an application restart.
  • bus policy file for the application software, wherein the bus policy file provides access control rights for the application software to communicate with other resources.
  • the action comprises at least one of preventing loading of the executable, stripping additional privileges from the executable, and logging the violation.
  • the restricting comprises at least one of disabling certain digital rights management keys, and preventing certain content from being decrypted, and executing the application kernel with the restricted security functionality.
  • the various exemplary embodiments may be implemented in hardware or special purpose circuits, software, logic or any combination thereof.
  • some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although the invention is not limited thereto.
  • the exemplary embodiments of the inventions may be practiced in various components such as integrated circuit chips and modules. It should thus be appreciated that the exemplary embodiments of this invention may be realized in an apparatus that is embodied as an integrated circuit, where the integrated circuit may comprise circuitry (as well as possibly firmware) for embodying at least one or more of a data processor, a digital signal processor, baseband circuitry and radio frequency circuitry that are configurable so as to operate in accordance with the exemplary embodiments of this invention. Further, it is noted that, in accordance with the exemplary embodiments, the terms application software and software application are non-limiting and can be used interchangeably.
  • connection means any connection or coupling, either direct or indirect, between two or more elements, and may encompass the presence of one or more intermediate elements between two elements that are “connected” or “coupled” together.
  • the coupling or connection between the elements can be physical, logical, or a combination thereof.
  • two elements may be considered to be “connected” or “coupled” together by the use of one or more wires, cables and/or printed electrical connections, as well as by the use of electromagnetic energy, such as electromagnetic energy having wavelengths in the radio frequency region, the microwave region and the optical (both visible and invisible) region, as several non-limiting and non-exhaustive examples.

Landscapes

  • Engineering & Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Databases & Information Systems (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Storage Device Security (AREA)

Claims (15)

  1. Verfahren, das Folgendes umfasst:
    Empfangen eines Pakets, das eine Binärdatei, die eine Anwendungssoftware repräsentiert, sowie eine verknüpfte Ressourcenerklärung umfasst, die Ressourcen anzeigt, die von der Anwendungssoftware benötigt werden, an einer Vorrichtung von einer Quelle;
    Extrahieren der Ressourcenerklärung aus dem Paket;
    Bilden einer Überschneidung der extrahierten Ressourcenerklärung und eines Satzes von erlaubten Ressourcen für die Quelle des Pakets, das von einer Richtlinie zur Softwarequelleneinstufung und Ressourcennutzung erhalten wird;
    Gewähren der Anwendungssoftwareressourcen auf Basis des Ergebnisses der gebildeten Überschneidung;
    Installieren der Anwendungssoftware; und
    Speichern einer Anzeige der gewährten Ressourcen in einer Ressourcenbesitzliste.
  2. Verfahren nach Anspruch 1, wobei die Ressourcenbesitzliste definiert, auf welche Ressourcen die Anwendungssoftware zugreifen darf, und wobei die Ressourcenbesitzliste eine Zuordnung zwischen einer Anwendungskennung der Anwendungssoftware und den erlaubten Ressourcen umfasst.
  3. Verfahren nach Anspruch 2, wobei die Anwendungskennung eine Anwendung eindeutig identifiziert und wobei die Anwendungskennung mindestens zwischen mehrmaligem Booten für verschiedene Instanzen einer selben Anwendung und nach einem Anwendungsneustart unverändert bleibt.
  4. Verfahren nach einem der Ansprüche 2 oder 3, wobei die Anwendungskennung durch AppID = {SourceID, PackageName, AppName} repräsentiert wird, wobei SourceID eine eindeutige Kennung einer Anwendungsquelle ist, wobei PackageName ein Paketname ohne eine Versionsnummer ist und wobei AppNamedurch einen Anwendungsentwickler definiert ist.
  5. Verfahren nach einem der vorhergehenden Ansprüche, das ferner Folgendes umfasst:
    Speichern eines kryptographischen Hash mit Quellkennungen der Binärdatei, die Rechten der Quelle zugeordnet sind, für die Binärdatei.
  6. Verfahren nach Anspruch 5, wobei eine Speicherung des kryptographischen Hash unter Verwendung einer lokalen digitalen Signatur mit geheimen Schlüsseln signiert wird.
  7. Verfahren nach einem der vorhergehenden Ansprüche, das ferner Folgendes umfasst:
    Modifizieren einer Busrichtliniendatei für die Anwendungssoftware, wobei die Busrichtliniendatei Zugriffssteuerrechte für die Anwendungssoftware zum Kommunizieren mit anderen Ressourcen bereitstellt.
  8. Verfahren nach einem der vorhergehenden Ansprüche, das ferner Folgendes umfasst:
    Initiieren einer Ausführung der Anwendungssoftware, das das Zugreifen auf die Ressourcenbesitzliste umfasst;
    Zuweisen von entsprechenden Prozesszugangsdaten, die in der Ressourcenbesitzliste definiert sind, gemäß erlaubten Ressourcen für die Anwendungssoftware;
    Übergeben der Steuerung an die Anwendungssoftware; und
    Ausführen der Anwendungssoftware.
  9. Verfahren nach Anspruch 8, das ferner Folgendes umfasst:
    in Reaktion auf eine Anforderung des Zugriffs auf ein Systemobjekt durch die Anwendungssoftware Bestimmen einer Zugriffssteuerung der Anwendungssoftware auf Basis der zugewiesenen Prozesszugangsdaten und einer Zugriffssteuerliste, die mit dem Systemobjekt verknüpft ist.
  10. Verfahren nach einem der vorhergehenden Ansprüche, das ferner Folgendes umfasst:
    Erstellen eines Ressourcentokens; und
    Gewähren des Ressourcentokens nur für ausgewählte Anwendungssoftware, die aus einem Softwarerepositorium kommt, das mit mindestens einem Bediener der Vorrichtung verknüpft ist.
  11. Verfahren nach Anspruch 10, das ferner Folgendes umfasst:
    Aufrechterhalten einer lokal eindeutigen Zuordnung zwischen dem Ressourcentoken und Identitäten des mindestens einen Bedieners der Vorrichtung, wobei das lokal eindeutige Zuordnen es erlaubt, eine Zugriffssteuerentscheidung dynamisch von der ausgewählten Anwendungssoftware an eine Schnittstelle der Vorrichtung zu binden.
  12. Verfahren nach Anspruch 10, wobei Dienste, die das Ressourcentoken verarbeiten, nur mit Anwendungen kommunizieren, denen das Ressourcentoken gewährt wurde.
  13. Nichttransitorisches computerlesbares Medium, das Softwareprogrammanweisungen enthält, wobei eine Ausführung der Softwareprogrammanweisungen durch mindestens einen Datenprozessor in einer Durchführung von Operationen, die eine Ausführung des Verfahrens nach einem der vorhergehenden Ansprüche umfassen, resultiert.
  14. Einrichtung, die Folgendes umfasst:
    Mittel zum Empfangen eines Pakets, das eine Binärdatei, die eine Anwendungssoftware repräsentiert, sowie eine verknüpfte Ressourcenerklärung umfasst, die Ressourcen anzeigt, die von der Anwendungssoftware benötigt werden, von einer Quelle;
    Mittel zum Extrahieren der Ressourcenerklärung aus dem Paket;
    Mittel zum Bilden einer Überschneidung der extrahierten Ressourcenerklärung und eines Satzes von erlaubten Ressourcen für die Quelle des Pakets, das von einer Richtlinie zur Softwarequelleneinstufung und Ressourcennutzung erhalten wird;
    Mittel zum Gewähren der Anwendungssoftwareressourcen auf Basis des Ergebnisses der gebildeten Überschneidung;
    Mittel zum Installieren der Anwendungssoftware; und
    Mittel zum Speichern einer Anzeige der gewährten Ressourcen in einer Ressourcenbesitzliste.
  15. Einrichtung nach Anspruch 14, die Mittel zum Durchführen eines Verfahrens nach einem der Ansprüche 2 bis 12 umfasst.
EP10821668.0A 2009-10-09 2010-10-09 Plattformsicherheit Active EP2486509B1 (de)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22204745.8A EP4191453A1 (de) 2009-10-09 2010-10-09 Plattformsicherheit

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US25012609P 2009-10-09 2009-10-09
PCT/IB2010/054572 WO2011042892A1 (en) 2009-10-09 2010-10-09 Platform security

Related Child Applications (1)

Application Number Title Priority Date Filing Date
EP22204745.8A Division EP4191453A1 (de) 2009-10-09 2010-10-09 Plattformsicherheit

Publications (3)

Publication Number Publication Date
EP2486509A1 EP2486509A1 (de) 2012-08-15
EP2486509A4 EP2486509A4 (de) 2016-11-30
EP2486509B1 true EP2486509B1 (de) 2022-11-02

Family

ID=43856421

Family Applications (2)

Application Number Title Priority Date Filing Date
EP22204745.8A Pending EP4191453A1 (de) 2009-10-09 2010-10-09 Plattformsicherheit
EP10821668.0A Active EP2486509B1 (de) 2009-10-09 2010-10-09 Plattformsicherheit

Family Applications Before (1)

Application Number Title Priority Date Filing Date
EP22204745.8A Pending EP4191453A1 (de) 2009-10-09 2010-10-09 Plattformsicherheit

Country Status (3)

Country Link
EP (2) EP4191453A1 (de)
CN (1) CN102640160B (de)
WO (1) WO2011042892A1 (de)

Families Citing this family (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103309768B (zh) * 2012-03-16 2015-03-11 腾讯科技（深圳）有限公司 系统文件修复方法和装置
CN104102538B (zh) * 2013-04-09 2018-02-27 联想(北京)有限公司 信息处理的方法及电子设备
TWI633458B (zh) * 2014-02-25 2018-08-21 美商凱為公司 用於對受保護的硬體資源的軟體啟用接入的半導體和電腦
DE102014206006A1 (de) * 2014-03-31 2015-10-01 Siemens Aktiengesellschaft Verfahren und Vorrichtung zum Manipulationsschutz einer Recheneinrichtung
JP6141242B2 (ja) * 2014-08-28 2017-06-07 三菱重工業株式会社 制御プログラム配信システム及びその方法
CN104408371B (zh) * 2014-10-14 2017-12-19 中国科学院信息工程研究所 一种基于可信执行环境高安全应用系统的实现方法
CN104376273A (zh) * 2014-11-18 2015-02-25 乐视致新电子科技（天津）有限公司 一种数据访问控制方法和装置
CN105787352A (zh) * 2014-12-18 2016-07-20 中兴通讯股份有限公司 一种可执行模块的提供、加载方法及终端
CN104507087A (zh) * 2014-12-19 2015-04-08 上海斐讯数据通信技术有限公司 移动办公的安全服务系统及安全服务方法
CN104778410B (zh) * 2015-04-16 2017-07-11 电子科技大学 一种应用程序完整性验证方法
CN104918116B (zh) * 2015-05-28 2018-10-23 北京视博数字电视科技有限公司 用于智能终端的资源播放方法及系统
US9942240B2 (en) 2015-07-21 2018-04-10 Citrix Systems, Inc. Anonymous application wrapping
CN105162586A (zh) * 2015-09-21 2015-12-16 北京元心科技有限公司 一种在使用D-Bus的智能设备中进行安全通讯的方法和系统
CN105306447B (zh) * 2015-09-21 2019-05-31 北京元心科技有限公司 一种在使用D-Bus的智能设备中进行安全访问的方法和系统
US11119789B2 (en) 2018-04-25 2021-09-14 Hewlett Packard Enterprise Development Lp Kernel space measurement
WO2020140257A1 (en) * 2019-01-04 2020-07-09 Baidu.Com Times Technology (Beijing) Co., Ltd. Method and system for validating kernel objects to be executed by a data processing accelerator of a host system
CN111221629B (zh) * 2020-01-09 2023-09-05 上海沄界信息科技有限公司 计算资源使用量量化方法及装置
US11907405B2 (en) 2020-10-14 2024-02-20 International Business Machines Corporation Secure data storage device access control and sharing

Family Cites Families (13)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5757915A (en) * 1995-08-25 1998-05-26 Intel Corporation Parameterized hash functions for access control
US6567917B1 (en) * 1999-02-01 2003-05-20 Cisco Technology, Inc. Method and system for providing tamper-resistant executable software
US7073059B2 (en) * 2001-06-08 2006-07-04 Hewlett-Packard Development Company, L.P. Secure machine platform that interfaces to operating systems and customized control programs
AR037011A1 (es) * 2001-08-13 2004-10-20 Qualcomm Inc Un metodo para almacenar una aplicacion en un dispositivo, un dispositivo para ejecutar una aplicacion con dicho metodo, metodos para permitir acceso a un recurso del dispositivo y asociar una lista de autorizacion a una aplicacion, sistemas para almacenar una aplicacion en un dispositivo, para perm
US20030037327A1 (en) * 2001-08-15 2003-02-20 International Business Machines Corporation Run-time rule-based topological installation suite
GB0326668D0 (en) * 2003-11-15 2003-12-17 Ibm Apparatus and method for providing a solution for a computer system
JP4164036B2 (ja) * 2004-02-05 2008-10-08 トレンドマイクロ株式会社 ネットワークを介して提供されるプログラムに対する受信装置上でのセキュリティの確保
WO2006101549A2 (en) * 2004-12-03 2006-09-28 Whitecell Software, Inc. Secure system for allowing the execution of authorized computer program code
US20060236122A1 (en) * 2005-04-15 2006-10-19 Microsoft Corporation Secure boot
JP4556857B2 (ja) * 2005-12-07 2010-10-06 セイコーエプソン株式会社 情報配信装置、情報配信装置の制御方法および制御プログラム
JP5270069B2 (ja) * 2006-04-04 2013-08-21 株式会社ブリヂストン ゴム組成物及びそれを用いた空気入りタイヤ
US8254568B2 (en) * 2007-01-07 2012-08-28 Apple Inc. Secure booting a computing device
US8856859B2 (en) * 2007-02-06 2014-10-07 Blackberry Limited System and method for setting application permissions

Also Published As

Publication number Publication date
EP4191453A1 (de) 2023-06-07
WO2011042892A1 (en) 2011-04-14
EP2486509A1 (de) 2012-08-15
CN102640160B (zh) 2015-02-11
EP2486509A4 (de) 2016-11-30
CN102640160A (zh) 2012-08-15

Similar Documents

Publication Publication Date Title
EP2486509B1 (de) Plattformsicherheit
US11356431B2 (en) Operating system integrated domain management
US11126706B2 (en) Hypervisor measurement agent
US10503545B2 (en) Universal security agent
CN107533609B (zh) 用于对系统中的多个可信执行环境进行控制的系统、设备和方法
US8856544B2 (en) System and method for providing secure virtual machines
US10073966B2 (en) Operating system-independent integrity verification
US8171295B2 (en) Information processing apparatus, a server apparatus, a method of an information processing apparatus, a method of a server apparatus, and an apparatus executable process
US10708067B2 (en) Platform attestation and registration for servers
US9838398B2 (en) Validating the identity of an application for application management
US8220029B2 (en) Method and system for enforcing trusted computing policies in a hypervisor security module architecture
EP3671508B1 (de) Anpassen von betriebssystemkernen mit sicheren kernmodulen
ES2352556T3 (es) Sistema y método de firma mediante código por software.
US11200300B2 (en) Secure sharing of license data in computing systems
US8752130B2 (en) Trusted multi-stakeholder environment
Sze et al. Hardening openstack cloud platforms against compute node compromises
Umar et al. Trusted Execution Environment and Host Card Emulation
CN116954693A (zh) 状态协同方法、装置、计算机设备及存储介质
Dive-Reclus et al. SYMBIAN OS PLATFORM SECURITY ARCHITECTURE

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

17P Request for examination filed

Effective date: 20120508

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

DAX Request for extension of the european patent (deleted)
RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: NOKIA CORPORATION

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: NOKIA TECHNOLOGIES OY

RA4 Supplementary search report drawn up and despatched (corrected)

Effective date: 20161028

RIC1 Information provided on ipc code assigned before grant

Ipc: G06F 21/62 20130101ALI20161024BHEP

Ipc: G06F 9/445 20060101ALI20161024BHEP

Ipc: H04L 29/06 20060101ALI20161024BHEP

Ipc: G06F 21/57 20130101AFI20161024BHEP

Ipc: G06F 9/46 20060101ALI20161024BHEP

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

17Q First examination report despatched

Effective date: 20190208

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: NOKIA TECHNOLOGIES OY

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: EXAMINATION IS IN PROGRESS

REG Reference to a national code

Ref country code: DE

Ref legal event code: R079

Ref document number: 602010068548

Country of ref document: DE

Free format text: PREVIOUS MAIN CLASS: G06F0021220000

Ipc: G06F0021570000

GRAP Despatch of communication of intention to grant a patent

Free format text: ORIGINAL CODE: EPIDOSNIGR1

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: GRANT OF PATENT IS INTENDED

RIC1 Information provided on ipc code assigned before grant

Ipc: H04L 9/40 20220101ALI20220509BHEP

Ipc: G06F 8/61 20180101ALI20220509BHEP

Ipc: G06F 21/62 20130101ALI20220509BHEP

Ipc: G06F 9/445 20060101ALI20220509BHEP

Ipc: G06F 9/46 20060101ALI20220509BHEP

Ipc: G06F 21/57 20130101AFI20220509BHEP

INTG Intention to grant announced

Effective date: 20220601

GRAS Grant fee paid

Free format text: ORIGINAL CODE: EPIDOSNIGR3

GRAA (expected) grant

Free format text: ORIGINAL CODE: 0009210

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE PATENT HAS BEEN GRANTED

AK Designated contracting states

Kind code of ref document: B1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

REG Reference to a national code

Ref country code: GB

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: CH

Ref legal event code: EP

Ref country code: AT

Ref legal event code: REF

Ref document number: 1529287

Country of ref document: AT

Kind code of ref document: T

Effective date: 20221115

REG Reference to a national code

Ref country code: DE

Ref legal event code: R096

Ref document number: 602010068548

Country of ref document: DE

REG Reference to a national code

Ref country code: IE

Ref legal event code: FG4D

REG Reference to a national code

Ref country code: LT

Ref legal event code: MG9D

REG Reference to a national code

Ref country code: NL

Ref legal event code: MP

Effective date: 20221102

REG Reference to a national code

Ref country code: AT

Ref legal event code: MK05

Ref document number: 1529287

Country of ref document: AT

Kind code of ref document: T

Effective date: 20221102

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: PT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230302

Ref country code: NO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230202

Ref country code: LT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: FI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: ES

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: AT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: RS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: PL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: LV

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: IS

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230302

Ref country code: HR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: GR

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20230203

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: NL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

P01 Opt-out of the competence of the unified patent court (upc) registered

Effective date: 20230527

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SM

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: RO

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: EE

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: DK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: CZ

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

REG Reference to a national code

Ref country code: DE

Ref legal event code: R097

Ref document number: 602010068548

Country of ref document: DE

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SK

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: AL

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

PLBE No opposition filed within time limit

Free format text: ORIGINAL CODE: 0009261

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: NO OPPOSITION FILED WITHIN TIME LIMIT

26N No opposition filed

Effective date: 20230803

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: GB

Payment date: 20230831

Year of fee payment: 14

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: SI

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: FR

Payment date: 20230911

Year of fee payment: 14

PGFP Annual fee paid to national office [announced via postgrant information from national office to epo]

Ref country code: DE

Payment date: 20230830

Year of fee payment: 14

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: IT

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

Ref country code: MC

Free format text: LAPSE BECAUSE OF FAILURE TO SUBMIT A TRANSLATION OF THE DESCRIPTION OR TO PAY THE FEE WITHIN THE PRESCRIBED TIME-LIMIT

Effective date: 20221102

REG Reference to a national code

Ref country code: CH

Ref legal event code: PL

PG25 Lapsed in a contracting state [announced via postgrant information from national office to epo]

Ref country code: LU

Free format text: LAPSE BECAUSE OF NON-PAYMENT OF DUE FEES

Effective date: 20231009